xref: /qemu/hw/i386/acpi-build.c (revision 0b7e89b103b899c21b9ab37dbf9b832db8d18108)
1 /* Support for generating ACPI tables and passing them to Guests
2  *
3  * Copyright (C) 2008-2010  Kevin O'Connor <kevin@koconnor.net>
4  * Copyright (C) 2006 Fabrice Bellard
5  * Copyright (C) 2013 Red Hat Inc
6  *
7  * Author: Michael S. Tsirkin <mst@redhat.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13 
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18 
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22 
23 #include "acpi-build.h"
24 #include <stddef.h>
25 #include <glib.h>
26 #include "qemu-common.h"
27 #include "qemu/bitmap.h"
28 #include "qemu/osdep.h"
29 #include "qemu/range.h"
30 #include "qemu/error-report.h"
31 #include "hw/pci/pci.h"
32 #include "qom/cpu.h"
33 #include "hw/i386/pc.h"
34 #include "target-i386/cpu.h"
35 #include "hw/timer/hpet.h"
36 #include "hw/i386/acpi-defs.h"
37 #include "hw/acpi/acpi.h"
38 #include "hw/nvram/fw_cfg.h"
39 #include "hw/acpi/bios-linker-loader.h"
40 #include "hw/loader.h"
41 #include "hw/isa/isa.h"
42 #include "hw/acpi/memory_hotplug.h"
43 #include "sysemu/tpm.h"
44 #include "hw/acpi/tpm.h"
45 
46 /* Supported chipsets: */
47 #include "hw/acpi/piix4.h"
48 #include "hw/acpi/pcihp.h"
49 #include "hw/i386/ich9.h"
50 #include "hw/pci/pci_bus.h"
51 #include "hw/pci-host/q35.h"
52 #include "hw/i386/intel_iommu.h"
53 
54 #include "hw/i386/q35-acpi-dsdt.hex"
55 #include "hw/i386/acpi-dsdt.hex"
56 
57 #include "qapi/qmp/qint.h"
58 #include "qom/qom-qobject.h"
59 #include "exec/ram_addr.h"
60 
61 /* These are used to size the ACPI tables for -M pc-i440fx-1.7 and
62  * -M pc-i440fx-2.0.  Even if the actual amount of AML generated grows
63  * a little bit, there should be plenty of free space since the DSDT
64  * shrunk by ~1.5k between QEMU 2.0 and QEMU 2.1.
65  */
66 #define ACPI_BUILD_LEGACY_CPU_AML_SIZE    97
67 #define ACPI_BUILD_ALIGN_SIZE             0x1000
68 
69 #define ACPI_BUILD_TABLE_SIZE             0x20000
70 
71 /* Reserve RAM space for tables: add another order of magnitude. */
72 #define ACPI_BUILD_TABLE_MAX_SIZE         0x200000
73 
74 /* #define DEBUG_ACPI_BUILD */
75 #ifdef DEBUG_ACPI_BUILD
76 #define ACPI_BUILD_DPRINTF(fmt, ...)        \
77     do {printf("ACPI_BUILD: " fmt, ## __VA_ARGS__); } while (0)
78 #else
79 #define ACPI_BUILD_DPRINTF(fmt, ...)
80 #endif
81 
82 typedef struct AcpiCpuInfo {
83     DECLARE_BITMAP(found_cpus, ACPI_CPU_HOTPLUG_ID_LIMIT);
84 } AcpiCpuInfo;
85 
86 typedef struct AcpiMcfgInfo {
87     uint64_t mcfg_base;
88     uint32_t mcfg_size;
89 } AcpiMcfgInfo;
90 
91 typedef struct AcpiPmInfo {
92     bool s3_disabled;
93     bool s4_disabled;
94     bool pcihp_bridge_en;
95     uint8_t s4_val;
96     uint16_t sci_int;
97     uint8_t acpi_enable_cmd;
98     uint8_t acpi_disable_cmd;
99     uint32_t gpe0_blk;
100     uint32_t gpe0_blk_len;
101     uint32_t io_base;
102 } AcpiPmInfo;
103 
104 typedef struct AcpiMiscInfo {
105     bool has_hpet;
106     bool has_tpm;
107     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
108     const unsigned char *dsdt_code;
109     unsigned dsdt_size;
110     uint16_t pvpanic_port;
111 } AcpiMiscInfo;
112 
113 typedef struct AcpiBuildPciBusHotplugState {
114     GArray *device_table;
115     GArray *notify_table;
116     struct AcpiBuildPciBusHotplugState *parent;
117     bool pcihp_bridge_en;
118 } AcpiBuildPciBusHotplugState;
119 
120 static void acpi_get_dsdt(AcpiMiscInfo *info)
121 {
122     uint16_t *applesmc_sta;
123     Object *piix = piix4_pm_find();
124     Object *lpc = ich9_lpc_find();
125     assert(!!piix != !!lpc);
126 
127     if (piix) {
128         info->dsdt_code = AcpiDsdtAmlCode;
129         info->dsdt_size = sizeof AcpiDsdtAmlCode;
130         applesmc_sta = piix_dsdt_applesmc_sta;
131     }
132     if (lpc) {
133         info->dsdt_code = Q35AcpiDsdtAmlCode;
134         info->dsdt_size = sizeof Q35AcpiDsdtAmlCode;
135         applesmc_sta = q35_dsdt_applesmc_sta;
136     }
137 
138     /* Patch in appropriate value for AppleSMC _STA */
139     *(uint8_t *)(info->dsdt_code + *applesmc_sta) =
140         applesmc_find() ? 0x0b : 0x00;
141 }
142 
143 static
144 int acpi_add_cpu_info(Object *o, void *opaque)
145 {
146     AcpiCpuInfo *cpu = opaque;
147     uint64_t apic_id;
148 
149     if (object_dynamic_cast(o, TYPE_CPU)) {
150         apic_id = object_property_get_int(o, "apic-id", NULL);
151         assert(apic_id < ACPI_CPU_HOTPLUG_ID_LIMIT);
152 
153         set_bit(apic_id, cpu->found_cpus);
154     }
155 
156     object_child_foreach(o, acpi_add_cpu_info, opaque);
157     return 0;
158 }
159 
160 static void acpi_get_cpu_info(AcpiCpuInfo *cpu)
161 {
162     Object *root = object_get_root();
163 
164     memset(cpu->found_cpus, 0, sizeof cpu->found_cpus);
165     object_child_foreach(root, acpi_add_cpu_info, cpu);
166 }
167 
168 static void acpi_get_pm_info(AcpiPmInfo *pm)
169 {
170     Object *piix = piix4_pm_find();
171     Object *lpc = ich9_lpc_find();
172     Object *obj = NULL;
173     QObject *o;
174 
175     if (piix) {
176         obj = piix;
177     }
178     if (lpc) {
179         obj = lpc;
180     }
181     assert(obj);
182 
183     /* Fill in optional s3/s4 related properties */
184     o = object_property_get_qobject(obj, ACPI_PM_PROP_S3_DISABLED, NULL);
185     if (o) {
186         pm->s3_disabled = qint_get_int(qobject_to_qint(o));
187     } else {
188         pm->s3_disabled = false;
189     }
190     qobject_decref(o);
191     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_DISABLED, NULL);
192     if (o) {
193         pm->s4_disabled = qint_get_int(qobject_to_qint(o));
194     } else {
195         pm->s4_disabled = false;
196     }
197     qobject_decref(o);
198     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_VAL, NULL);
199     if (o) {
200         pm->s4_val = qint_get_int(qobject_to_qint(o));
201     } else {
202         pm->s4_val = false;
203     }
204     qobject_decref(o);
205 
206     /* Fill in mandatory properties */
207     pm->sci_int = object_property_get_int(obj, ACPI_PM_PROP_SCI_INT, NULL);
208 
209     pm->acpi_enable_cmd = object_property_get_int(obj,
210                                                   ACPI_PM_PROP_ACPI_ENABLE_CMD,
211                                                   NULL);
212     pm->acpi_disable_cmd = object_property_get_int(obj,
213                                                   ACPI_PM_PROP_ACPI_DISABLE_CMD,
214                                                   NULL);
215     pm->io_base = object_property_get_int(obj, ACPI_PM_PROP_PM_IO_BASE,
216                                           NULL);
217     pm->gpe0_blk = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK,
218                                            NULL);
219     pm->gpe0_blk_len = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK_LEN,
220                                                NULL);
221     pm->pcihp_bridge_en =
222         object_property_get_bool(obj, "acpi-pci-hotplug-with-bridge-support",
223                                  NULL);
224 }
225 
226 static void acpi_get_misc_info(AcpiMiscInfo *info)
227 {
228     info->has_hpet = hpet_find();
229     info->has_tpm = tpm_find();
230     info->pvpanic_port = pvpanic_port();
231 }
232 
233 static void acpi_get_pci_info(PcPciInfo *info)
234 {
235     Object *pci_host;
236     bool ambiguous;
237 
238     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
239     g_assert(!ambiguous);
240     g_assert(pci_host);
241 
242     info->w32.begin = object_property_get_int(pci_host,
243                                               PCI_HOST_PROP_PCI_HOLE_START,
244                                               NULL);
245     info->w32.end = object_property_get_int(pci_host,
246                                             PCI_HOST_PROP_PCI_HOLE_END,
247                                             NULL);
248     info->w64.begin = object_property_get_int(pci_host,
249                                               PCI_HOST_PROP_PCI_HOLE64_START,
250                                               NULL);
251     info->w64.end = object_property_get_int(pci_host,
252                                             PCI_HOST_PROP_PCI_HOLE64_END,
253                                             NULL);
254 }
255 
256 #define ACPI_BUILD_APPNAME  "Bochs"
257 #define ACPI_BUILD_APPNAME6 "BOCHS "
258 #define ACPI_BUILD_APPNAME4 "BXPC"
259 
260 #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
261 #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
262 #define ACPI_BUILD_TPMLOG_FILE "etc/tpm/log"
263 
264 static void
265 build_header(GArray *linker, GArray *table_data,
266              AcpiTableHeader *h, const char *sig, int len, uint8_t rev)
267 {
268     memcpy(&h->signature, sig, 4);
269     h->length = cpu_to_le32(len);
270     h->revision = rev;
271     memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);
272     memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);
273     memcpy(h->oem_table_id + 4, sig, 4);
274     h->oem_revision = cpu_to_le32(1);
275     memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);
276     h->asl_compiler_revision = cpu_to_le32(1);
277     h->checksum = 0;
278     /* Checksum to be filled in by Guest linker */
279     bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,
280                                     table_data->data, h, len, &h->checksum);
281 }
282 
283 static inline GArray *build_alloc_array(void)
284 {
285     return g_array_new(false, true /* clear */, 1);
286 }
287 
288 static inline void build_free_array(GArray *array)
289 {
290     g_array_free(array, true);
291 }
292 
293 static inline void build_prepend_byte(GArray *array, uint8_t val)
294 {
295     g_array_prepend_val(array, val);
296 }
297 
298 static inline void build_append_byte(GArray *array, uint8_t val)
299 {
300     g_array_append_val(array, val);
301 }
302 
303 static inline void build_append_array(GArray *array, GArray *val)
304 {
305     g_array_append_vals(array, val->data, val->len);
306 }
307 
308 #define ACPI_NAMESEG_LEN 4
309 
310 static void GCC_FMT_ATTR(2, 3)
311 build_append_nameseg(GArray *array, const char *format, ...)
312 {
313     /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
314     char s[] = "XXXX";
315     int len;
316     va_list args;
317 
318     va_start(args, format);
319     len = vsnprintf(s, sizeof s, format, args);
320     va_end(args);
321 
322     assert(len <= ACPI_NAMESEG_LEN);
323 
324     g_array_append_vals(array, s, len);
325     /* Pad up to ACPI_NAMESEG_LEN characters if necessary. */
326     g_array_append_vals(array, "____", ACPI_NAMESEG_LEN - len);
327 }
328 
329 /* 5.4 Definition Block Encoding */
330 enum {
331     PACKAGE_LENGTH_1BYTE_SHIFT = 6, /* Up to 63 - use extra 2 bits. */
332     PACKAGE_LENGTH_2BYTE_SHIFT = 4,
333     PACKAGE_LENGTH_3BYTE_SHIFT = 12,
334     PACKAGE_LENGTH_4BYTE_SHIFT = 20,
335 };
336 
337 static void build_prepend_package_length(GArray *package, unsigned min_bytes)
338 {
339     uint8_t byte;
340     unsigned length = package->len;
341     unsigned length_bytes;
342 
343     if (length + 1 < (1 << PACKAGE_LENGTH_1BYTE_SHIFT)) {
344         length_bytes = 1;
345     } else if (length + 2 < (1 << PACKAGE_LENGTH_3BYTE_SHIFT)) {
346         length_bytes = 2;
347     } else if (length + 3 < (1 << PACKAGE_LENGTH_4BYTE_SHIFT)) {
348         length_bytes = 3;
349     } else {
350         length_bytes = 4;
351     }
352 
353     /* Force length to at least min_bytes.
354      * This wastes memory but that's how bios did it.
355      */
356     length_bytes = MAX(length_bytes, min_bytes);
357 
358     /* PkgLength is the length of the inclusive length of the data. */
359     length += length_bytes;
360 
361     switch (length_bytes) {
362     case 1:
363         byte = length;
364         build_prepend_byte(package, byte);
365         return;
366     case 4:
367         byte = length >> PACKAGE_LENGTH_4BYTE_SHIFT;
368         build_prepend_byte(package, byte);
369         length &= (1 << PACKAGE_LENGTH_4BYTE_SHIFT) - 1;
370         /* fall through */
371     case 3:
372         byte = length >> PACKAGE_LENGTH_3BYTE_SHIFT;
373         build_prepend_byte(package, byte);
374         length &= (1 << PACKAGE_LENGTH_3BYTE_SHIFT) - 1;
375         /* fall through */
376     case 2:
377         byte = length >> PACKAGE_LENGTH_2BYTE_SHIFT;
378         build_prepend_byte(package, byte);
379         length &= (1 << PACKAGE_LENGTH_2BYTE_SHIFT) - 1;
380         /* fall through */
381     }
382     /*
383      * Most significant two bits of byte zero indicate how many following bytes
384      * are in PkgLength encoding.
385      */
386     byte = ((length_bytes - 1) << PACKAGE_LENGTH_1BYTE_SHIFT) | length;
387     build_prepend_byte(package, byte);
388 }
389 
390 static void build_package(GArray *package, uint8_t op, unsigned min_bytes)
391 {
392     build_prepend_package_length(package, min_bytes);
393     build_prepend_byte(package, op);
394 }
395 
396 static void build_extop_package(GArray *package, uint8_t op)
397 {
398     build_package(package, op, 1);
399     build_prepend_byte(package, 0x5B); /* ExtOpPrefix */
400 }
401 
402 static void build_append_value(GArray *table, uint32_t value, int size)
403 {
404     uint8_t prefix;
405     int i;
406 
407     switch (size) {
408     case 1:
409         prefix = 0x0A; /* BytePrefix */
410         break;
411     case 2:
412         prefix = 0x0B; /* WordPrefix */
413         break;
414     case 4:
415         prefix = 0x0C; /* DWordPrefix */
416         break;
417     default:
418         assert(0);
419         return;
420     }
421     build_append_byte(table, prefix);
422     for (i = 0; i < size; ++i) {
423         build_append_byte(table, value & 0xFF);
424         value = value >> 8;
425     }
426 }
427 
428 static void build_append_int(GArray *table, uint32_t value)
429 {
430     if (value == 0x00) {
431         build_append_byte(table, 0x00); /* ZeroOp */
432     } else if (value == 0x01) {
433         build_append_byte(table, 0x01); /* OneOp */
434     } else if (value <= 0xFF) {
435         build_append_value(table, value, 1);
436     } else if (value <= 0xFFFF) {
437         build_append_value(table, value, 2);
438     } else {
439         build_append_value(table, value, 4);
440     }
441 }
442 
443 static GArray *build_alloc_method(const char *name, uint8_t arg_count)
444 {
445     GArray *method = build_alloc_array();
446 
447     build_append_nameseg(method, "%s", name);
448     build_append_byte(method, arg_count); /* MethodFlags: ArgCount */
449 
450     return method;
451 }
452 
453 static void build_append_and_cleanup_method(GArray *device, GArray *method)
454 {
455     uint8_t op = 0x14; /* MethodOp */
456 
457     build_package(method, op, 0);
458 
459     build_append_array(device, method);
460     build_free_array(method);
461 }
462 
463 static void build_append_notify_target_ifequal(GArray *method,
464                                                GArray *target_name,
465                                                uint32_t value, int size)
466 {
467     GArray *notify = build_alloc_array();
468     uint8_t op = 0xA0; /* IfOp */
469 
470     build_append_byte(notify, 0x93); /* LEqualOp */
471     build_append_byte(notify, 0x68); /* Arg0Op */
472     build_append_value(notify, value, size);
473     build_append_byte(notify, 0x86); /* NotifyOp */
474     build_append_array(notify, target_name);
475     build_append_byte(notify, 0x69); /* Arg1Op */
476 
477     /* Pack it up */
478     build_package(notify, op, 1);
479 
480     build_append_array(method, notify);
481 
482     build_free_array(notify);
483 }
484 
485 /* End here */
486 #define ACPI_PORT_SMI_CMD           0x00b2 /* TODO: this is APM_CNT_IOPORT */
487 
488 static inline void *acpi_data_push(GArray *table_data, unsigned size)
489 {
490     unsigned off = table_data->len;
491     g_array_set_size(table_data, off + size);
492     return table_data->data + off;
493 }
494 
495 static unsigned acpi_data_len(GArray *table)
496 {
497 #if GLIB_CHECK_VERSION(2, 22, 0)
498     assert(g_array_get_element_size(table) == 1);
499 #endif
500     return table->len;
501 }
502 
503 static void acpi_align_size(GArray *blob, unsigned align)
504 {
505     /* Align size to multiple of given size. This reduces the chance
506      * we need to change size in the future (breaking cross version migration).
507      */
508     g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
509 }
510 
511 /* Set a value within table in a safe manner */
512 #define ACPI_BUILD_SET_LE(table, size, off, bits, val) \
513     do { \
514         uint64_t ACPI_BUILD_SET_LE_val = cpu_to_le64(val); \
515         memcpy(acpi_data_get_ptr(table, size, off, \
516                                  (bits) / BITS_PER_BYTE), \
517                &ACPI_BUILD_SET_LE_val, \
518                (bits) / BITS_PER_BYTE); \
519     } while (0)
520 
521 static inline void *acpi_data_get_ptr(uint8_t *table_data, unsigned table_size,
522                                       unsigned off, unsigned size)
523 {
524     assert(off + size > off);
525     assert(off + size <= table_size);
526     return table_data + off;
527 }
528 
529 static inline void acpi_add_table(GArray *table_offsets, GArray *table_data)
530 {
531     uint32_t offset = cpu_to_le32(table_data->len);
532     g_array_append_val(table_offsets, offset);
533 }
534 
535 /* FACS */
536 static void
537 build_facs(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
538 {
539     AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);
540     memcpy(&facs->signature, "FACS", 4);
541     facs->length = cpu_to_le32(sizeof(*facs));
542 }
543 
544 /* Load chipset information in FADT */
545 static void fadt_setup(AcpiFadtDescriptorRev1 *fadt, AcpiPmInfo *pm)
546 {
547     fadt->model = 1;
548     fadt->reserved1 = 0;
549     fadt->sci_int = cpu_to_le16(pm->sci_int);
550     fadt->smi_cmd = cpu_to_le32(ACPI_PORT_SMI_CMD);
551     fadt->acpi_enable = pm->acpi_enable_cmd;
552     fadt->acpi_disable = pm->acpi_disable_cmd;
553     /* EVT, CNT, TMR offset matches hw/acpi/core.c */
554     fadt->pm1a_evt_blk = cpu_to_le32(pm->io_base);
555     fadt->pm1a_cnt_blk = cpu_to_le32(pm->io_base + 0x04);
556     fadt->pm_tmr_blk = cpu_to_le32(pm->io_base + 0x08);
557     fadt->gpe0_blk = cpu_to_le32(pm->gpe0_blk);
558     /* EVT, CNT, TMR length matches hw/acpi/core.c */
559     fadt->pm1_evt_len = 4;
560     fadt->pm1_cnt_len = 2;
561     fadt->pm_tmr_len = 4;
562     fadt->gpe0_blk_len = pm->gpe0_blk_len;
563     fadt->plvl2_lat = cpu_to_le16(0xfff); /* C2 state not supported */
564     fadt->plvl3_lat = cpu_to_le16(0xfff); /* C3 state not supported */
565     fadt->flags = cpu_to_le32((1 << ACPI_FADT_F_WBINVD) |
566                               (1 << ACPI_FADT_F_PROC_C1) |
567                               (1 << ACPI_FADT_F_SLP_BUTTON) |
568                               (1 << ACPI_FADT_F_RTC_S4));
569     fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_USE_PLATFORM_CLOCK);
570     /* APIC destination mode ("Flat Logical") has an upper limit of 8 CPUs
571      * For more than 8 CPUs, "Clustered Logical" mode has to be used
572      */
573     if (max_cpus > 8) {
574         fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_FORCE_APIC_CLUSTER_MODEL);
575     }
576 }
577 
578 
579 /* FADT */
580 static void
581 build_fadt(GArray *table_data, GArray *linker, AcpiPmInfo *pm,
582            unsigned facs, unsigned dsdt)
583 {
584     AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
585 
586     fadt->firmware_ctrl = cpu_to_le32(facs);
587     /* FACS address to be filled by Guest linker */
588     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
589                                    ACPI_BUILD_TABLE_FILE,
590                                    table_data, &fadt->firmware_ctrl,
591                                    sizeof fadt->firmware_ctrl);
592 
593     fadt->dsdt = cpu_to_le32(dsdt);
594     /* DSDT address to be filled by Guest linker */
595     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
596                                    ACPI_BUILD_TABLE_FILE,
597                                    table_data, &fadt->dsdt,
598                                    sizeof fadt->dsdt);
599 
600     fadt_setup(fadt, pm);
601 
602     build_header(linker, table_data,
603                  (void *)fadt, "FACP", sizeof(*fadt), 1);
604 }
605 
606 static void
607 build_madt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu,
608            PcGuestInfo *guest_info)
609 {
610     int madt_start = table_data->len;
611 
612     AcpiMultipleApicTable *madt;
613     AcpiMadtIoApic *io_apic;
614     AcpiMadtIntsrcovr *intsrcovr;
615     AcpiMadtLocalNmi *local_nmi;
616     int i;
617 
618     madt = acpi_data_push(table_data, sizeof *madt);
619     madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS);
620     madt->flags = cpu_to_le32(1);
621 
622     for (i = 0; i < guest_info->apic_id_limit; i++) {
623         AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic);
624         apic->type = ACPI_APIC_PROCESSOR;
625         apic->length = sizeof(*apic);
626         apic->processor_id = i;
627         apic->local_apic_id = i;
628         if (test_bit(i, cpu->found_cpus)) {
629             apic->flags = cpu_to_le32(1);
630         } else {
631             apic->flags = cpu_to_le32(0);
632         }
633     }
634     io_apic = acpi_data_push(table_data, sizeof *io_apic);
635     io_apic->type = ACPI_APIC_IO;
636     io_apic->length = sizeof(*io_apic);
637 #define ACPI_BUILD_IOAPIC_ID 0x0
638     io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID;
639     io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS);
640     io_apic->interrupt = cpu_to_le32(0);
641 
642     if (guest_info->apic_xrupt_override) {
643         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
644         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
645         intsrcovr->length = sizeof(*intsrcovr);
646         intsrcovr->source = 0;
647         intsrcovr->gsi    = cpu_to_le32(2);
648         intsrcovr->flags  = cpu_to_le16(0); /* conforms to bus specifications */
649     }
650     for (i = 1; i < 16; i++) {
651 #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11))
652         if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) {
653             /* No need for a INT source override structure. */
654             continue;
655         }
656         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
657         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
658         intsrcovr->length = sizeof(*intsrcovr);
659         intsrcovr->source = i;
660         intsrcovr->gsi    = cpu_to_le32(i);
661         intsrcovr->flags  = cpu_to_le16(0xd); /* active high, level triggered */
662     }
663 
664     local_nmi = acpi_data_push(table_data, sizeof *local_nmi);
665     local_nmi->type         = ACPI_APIC_LOCAL_NMI;
666     local_nmi->length       = sizeof(*local_nmi);
667     local_nmi->processor_id = 0xff; /* all processors */
668     local_nmi->flags        = cpu_to_le16(0);
669     local_nmi->lint         = 1; /* ACPI_LINT1 */
670 
671     build_header(linker, table_data,
672                  (void *)(table_data->data + madt_start), "APIC",
673                  table_data->len - madt_start, 1);
674 }
675 
676 /* Encode a hex value */
677 static inline char acpi_get_hex(uint32_t val)
678 {
679     val &= 0x0f;
680     return (val <= 9) ? ('0' + val) : ('A' + val - 10);
681 }
682 
683 #include "hw/i386/ssdt-proc.hex"
684 
685 /* 0x5B 0x83 ProcessorOp PkgLength NameString ProcID */
686 #define ACPI_PROC_OFFSET_CPUHEX (*ssdt_proc_name - *ssdt_proc_start + 2)
687 #define ACPI_PROC_OFFSET_CPUID1 (*ssdt_proc_name - *ssdt_proc_start + 4)
688 #define ACPI_PROC_OFFSET_CPUID2 (*ssdt_proc_id - *ssdt_proc_start)
689 #define ACPI_PROC_SIZEOF (*ssdt_proc_end - *ssdt_proc_start)
690 #define ACPI_PROC_AML (ssdp_proc_aml + *ssdt_proc_start)
691 
692 /* 0x5B 0x82 DeviceOp PkgLength NameString */
693 #define ACPI_PCIHP_OFFSET_HEX (*ssdt_pcihp_name - *ssdt_pcihp_start + 1)
694 #define ACPI_PCIHP_OFFSET_ID (*ssdt_pcihp_id - *ssdt_pcihp_start)
695 #define ACPI_PCIHP_OFFSET_ADR (*ssdt_pcihp_adr - *ssdt_pcihp_start)
696 #define ACPI_PCIHP_OFFSET_EJ0 (*ssdt_pcihp_ej0 - *ssdt_pcihp_start)
697 #define ACPI_PCIHP_SIZEOF (*ssdt_pcihp_end - *ssdt_pcihp_start)
698 #define ACPI_PCIHP_AML (ssdp_pcihp_aml + *ssdt_pcihp_start)
699 
700 #define ACPI_PCINOHP_OFFSET_HEX (*ssdt_pcinohp_name - *ssdt_pcinohp_start + 1)
701 #define ACPI_PCINOHP_OFFSET_ADR (*ssdt_pcinohp_adr - *ssdt_pcinohp_start)
702 #define ACPI_PCINOHP_SIZEOF (*ssdt_pcinohp_end - *ssdt_pcinohp_start)
703 #define ACPI_PCINOHP_AML (ssdp_pcihp_aml + *ssdt_pcinohp_start)
704 
705 #define ACPI_PCIVGA_OFFSET_HEX (*ssdt_pcivga_name - *ssdt_pcivga_start + 1)
706 #define ACPI_PCIVGA_OFFSET_ADR (*ssdt_pcivga_adr - *ssdt_pcivga_start)
707 #define ACPI_PCIVGA_SIZEOF (*ssdt_pcivga_end - *ssdt_pcivga_start)
708 #define ACPI_PCIVGA_AML (ssdp_pcihp_aml + *ssdt_pcivga_start)
709 
710 #define ACPI_PCIQXL_OFFSET_HEX (*ssdt_pciqxl_name - *ssdt_pciqxl_start + 1)
711 #define ACPI_PCIQXL_OFFSET_ADR (*ssdt_pciqxl_adr - *ssdt_pciqxl_start)
712 #define ACPI_PCIQXL_SIZEOF (*ssdt_pciqxl_end - *ssdt_pciqxl_start)
713 #define ACPI_PCIQXL_AML (ssdp_pcihp_aml + *ssdt_pciqxl_start)
714 
715 #include "hw/i386/ssdt-mem.hex"
716 
717 /* 0x5B 0x82 DeviceOp PkgLength NameString DimmID */
718 #define ACPI_MEM_OFFSET_HEX (*ssdt_mem_name - *ssdt_mem_start + 2)
719 #define ACPI_MEM_OFFSET_ID (*ssdt_mem_id - *ssdt_mem_start + 7)
720 #define ACPI_MEM_SIZEOF (*ssdt_mem_end - *ssdt_mem_start)
721 #define ACPI_MEM_AML (ssdm_mem_aml + *ssdt_mem_start)
722 
723 #define ACPI_SSDT_SIGNATURE 0x54445353 /* SSDT */
724 #define ACPI_SSDT_HEADER_LENGTH 36
725 
726 #include "hw/i386/ssdt-misc.hex"
727 #include "hw/i386/ssdt-pcihp.hex"
728 #include "hw/i386/ssdt-tpm.hex"
729 
730 static void
731 build_append_notify_method(GArray *device, const char *name,
732                            const char *format, int count)
733 {
734     int i;
735     GArray *method = build_alloc_method(name, 2);
736 
737     for (i = 0; i < count; i++) {
738         GArray *target = build_alloc_array();
739         build_append_nameseg(target, format, i);
740         assert(i < 256); /* Fits in 1 byte */
741         build_append_notify_target_ifequal(method, target, i, 1);
742         build_free_array(target);
743     }
744 
745     build_append_and_cleanup_method(device, method);
746 }
747 
748 static void patch_pcihp(int slot, uint8_t *ssdt_ptr)
749 {
750     unsigned devfn = PCI_DEVFN(slot, 0);
751 
752     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
753     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
754     ssdt_ptr[ACPI_PCIHP_OFFSET_ID] = slot;
755     ssdt_ptr[ACPI_PCIHP_OFFSET_ADR + 2] = slot;
756 }
757 
758 static void patch_pcinohp(int slot, uint8_t *ssdt_ptr)
759 {
760     unsigned devfn = PCI_DEVFN(slot, 0);
761 
762     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
763     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
764     ssdt_ptr[ACPI_PCINOHP_OFFSET_ADR + 2] = slot;
765 }
766 
767 static void patch_pcivga(int slot, uint8_t *ssdt_ptr)
768 {
769     unsigned devfn = PCI_DEVFN(slot, 0);
770 
771     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
772     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX + 1] = acpi_get_hex(devfn);
773     ssdt_ptr[ACPI_PCIVGA_OFFSET_ADR + 2] = slot;
774 }
775 
776 static void patch_pciqxl(int slot, uint8_t *ssdt_ptr)
777 {
778     unsigned devfn = PCI_DEVFN(slot, 0);
779 
780     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
781     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX + 1] = acpi_get_hex(devfn);
782     ssdt_ptr[ACPI_PCIQXL_OFFSET_ADR + 2] = slot;
783 }
784 
785 /* Assign BSEL property to all buses.  In the future, this can be changed
786  * to only assign to buses that support hotplug.
787  */
788 static void *acpi_set_bsel(PCIBus *bus, void *opaque)
789 {
790     unsigned *bsel_alloc = opaque;
791     unsigned *bus_bsel;
792 
793     if (qbus_is_hotpluggable(BUS(bus))) {
794         bus_bsel = g_malloc(sizeof *bus_bsel);
795 
796         *bus_bsel = (*bsel_alloc)++;
797         object_property_add_uint32_ptr(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,
798                                        bus_bsel, NULL);
799     }
800 
801     return bsel_alloc;
802 }
803 
804 static void acpi_set_pci_info(void)
805 {
806     PCIBus *bus = find_i440fx(); /* TODO: Q35 support */
807     unsigned bsel_alloc = 0;
808 
809     if (bus) {
810         /* Scan all PCI buses. Set property to enable acpi based hotplug. */
811         pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &bsel_alloc);
812     }
813 }
814 
815 static void build_pci_bus_state_init(AcpiBuildPciBusHotplugState *state,
816                                      AcpiBuildPciBusHotplugState *parent,
817                                      bool pcihp_bridge_en)
818 {
819     state->parent = parent;
820     state->device_table = build_alloc_array();
821     state->notify_table = build_alloc_array();
822     state->pcihp_bridge_en = pcihp_bridge_en;
823 }
824 
825 static void build_pci_bus_state_cleanup(AcpiBuildPciBusHotplugState *state)
826 {
827     build_free_array(state->device_table);
828     build_free_array(state->notify_table);
829 }
830 
831 static void *build_pci_bus_begin(PCIBus *bus, void *parent_state)
832 {
833     AcpiBuildPciBusHotplugState *parent = parent_state;
834     AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);
835 
836     build_pci_bus_state_init(child, parent, parent->pcihp_bridge_en);
837 
838     return child;
839 }
840 
841 static void build_pci_bus_end(PCIBus *bus, void *bus_state)
842 {
843     AcpiBuildPciBusHotplugState *child = bus_state;
844     AcpiBuildPciBusHotplugState *parent = child->parent;
845     GArray *bus_table = build_alloc_array();
846     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
847     DECLARE_BITMAP(slot_device_present, PCI_SLOT_MAX);
848     DECLARE_BITMAP(slot_device_system, PCI_SLOT_MAX);
849     DECLARE_BITMAP(slot_device_vga, PCI_SLOT_MAX);
850     DECLARE_BITMAP(slot_device_qxl, PCI_SLOT_MAX);
851     uint8_t op;
852     int i;
853     QObject *bsel;
854     GArray *method;
855     bool bus_hotplug_support = false;
856 
857     /*
858      * Skip bridge subtree creation if bridge hotplug is disabled
859      * to make acpi tables compatible with legacy machine types.
860      */
861     if (!child->pcihp_bridge_en && bus->parent_dev) {
862         return;
863     }
864 
865     if (bus->parent_dev) {
866         op = 0x82; /* DeviceOp */
867         build_append_nameseg(bus_table, "S%.02X",
868                              bus->parent_dev->devfn);
869         build_append_byte(bus_table, 0x08); /* NameOp */
870         build_append_nameseg(bus_table, "_SUN");
871         build_append_value(bus_table, PCI_SLOT(bus->parent_dev->devfn), 1);
872         build_append_byte(bus_table, 0x08); /* NameOp */
873         build_append_nameseg(bus_table, "_ADR");
874         build_append_value(bus_table, (PCI_SLOT(bus->parent_dev->devfn) << 16) |
875                            PCI_FUNC(bus->parent_dev->devfn), 4);
876     } else {
877         op = 0x10; /* ScopeOp */;
878         build_append_nameseg(bus_table, "PCI0");
879     }
880 
881     bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
882     if (bsel) {
883         build_append_byte(bus_table, 0x08); /* NameOp */
884         build_append_nameseg(bus_table, "BSEL");
885         build_append_int(bus_table, qint_get_int(qobject_to_qint(bsel)));
886         memset(slot_hotplug_enable, 0xff, sizeof slot_hotplug_enable);
887     } else {
888         /* No bsel - no slots are hot-pluggable */
889         memset(slot_hotplug_enable, 0x00, sizeof slot_hotplug_enable);
890     }
891 
892     memset(slot_device_present, 0x00, sizeof slot_device_present);
893     memset(slot_device_system, 0x00, sizeof slot_device_present);
894     memset(slot_device_vga, 0x00, sizeof slot_device_vga);
895     memset(slot_device_qxl, 0x00, sizeof slot_device_qxl);
896 
897     for (i = 0; i < ARRAY_SIZE(bus->devices); i += PCI_FUNC_MAX) {
898         DeviceClass *dc;
899         PCIDeviceClass *pc;
900         PCIDevice *pdev = bus->devices[i];
901         int slot = PCI_SLOT(i);
902         bool bridge_in_acpi;
903 
904         if (!pdev) {
905             continue;
906         }
907 
908         set_bit(slot, slot_device_present);
909         pc = PCI_DEVICE_GET_CLASS(pdev);
910         dc = DEVICE_GET_CLASS(pdev);
911 
912         /* When hotplug for bridges is enabled, bridges are
913          * described in ACPI separately (see build_pci_bus_end).
914          * In this case they aren't themselves hot-pluggable.
915          */
916         bridge_in_acpi = pc->is_bridge && child->pcihp_bridge_en;
917 
918         if (pc->class_id == PCI_CLASS_BRIDGE_ISA || bridge_in_acpi) {
919             set_bit(slot, slot_device_system);
920         }
921 
922         if (pc->class_id == PCI_CLASS_DISPLAY_VGA) {
923             set_bit(slot, slot_device_vga);
924 
925             if (object_dynamic_cast(OBJECT(pdev), "qxl-vga")) {
926                 set_bit(slot, slot_device_qxl);
927             }
928         }
929 
930         if (!dc->hotpluggable || bridge_in_acpi) {
931             clear_bit(slot, slot_hotplug_enable);
932         }
933     }
934 
935     /* Append Device object for each slot */
936     for (i = 0; i < PCI_SLOT_MAX; i++) {
937         bool can_eject = test_bit(i, slot_hotplug_enable);
938         bool present = test_bit(i, slot_device_present);
939         bool vga = test_bit(i, slot_device_vga);
940         bool qxl = test_bit(i, slot_device_qxl);
941         bool system = test_bit(i, slot_device_system);
942         if (can_eject) {
943             void *pcihp = acpi_data_push(bus_table,
944                                          ACPI_PCIHP_SIZEOF);
945             memcpy(pcihp, ACPI_PCIHP_AML, ACPI_PCIHP_SIZEOF);
946             patch_pcihp(i, pcihp);
947             bus_hotplug_support = true;
948         } else if (qxl) {
949             void *pcihp = acpi_data_push(bus_table,
950                                          ACPI_PCIQXL_SIZEOF);
951             memcpy(pcihp, ACPI_PCIQXL_AML, ACPI_PCIQXL_SIZEOF);
952             patch_pciqxl(i, pcihp);
953         } else if (vga) {
954             void *pcihp = acpi_data_push(bus_table,
955                                          ACPI_PCIVGA_SIZEOF);
956             memcpy(pcihp, ACPI_PCIVGA_AML, ACPI_PCIVGA_SIZEOF);
957             patch_pcivga(i, pcihp);
958         } else if (system) {
959             /* Nothing to do: system devices are in DSDT or in SSDT above. */
960         } else if (present) {
961             void *pcihp = acpi_data_push(bus_table,
962                                          ACPI_PCINOHP_SIZEOF);
963             memcpy(pcihp, ACPI_PCINOHP_AML, ACPI_PCINOHP_SIZEOF);
964             patch_pcinohp(i, pcihp);
965         }
966     }
967 
968     if (bsel) {
969         method = build_alloc_method("DVNT", 2);
970 
971         for (i = 0; i < PCI_SLOT_MAX; i++) {
972             GArray *notify;
973             uint8_t op;
974 
975             if (!test_bit(i, slot_hotplug_enable)) {
976                 continue;
977             }
978 
979             notify = build_alloc_array();
980             op = 0xA0; /* IfOp */
981 
982             build_append_byte(notify, 0x7B); /* AndOp */
983             build_append_byte(notify, 0x68); /* Arg0Op */
984             build_append_int(notify, 0x1U << i);
985             build_append_byte(notify, 0x00); /* NullName */
986             build_append_byte(notify, 0x86); /* NotifyOp */
987             build_append_nameseg(notify, "S%.02X", PCI_DEVFN(i, 0));
988             build_append_byte(notify, 0x69); /* Arg1Op */
989 
990             /* Pack it up */
991             build_package(notify, op, 0);
992 
993             build_append_array(method, notify);
994 
995             build_free_array(notify);
996         }
997 
998         build_append_and_cleanup_method(bus_table, method);
999     }
1000 
1001     /* Append PCNT method to notify about events on local and child buses.
1002      * Add unconditionally for root since DSDT expects it.
1003      */
1004     if (bus_hotplug_support || child->notify_table->len || !bus->parent_dev) {
1005         method = build_alloc_method("PCNT", 0);
1006 
1007         /* If bus supports hotplug select it and notify about local events */
1008         if (bsel) {
1009             build_append_byte(method, 0x70); /* StoreOp */
1010             build_append_int(method, qint_get_int(qobject_to_qint(bsel)));
1011             build_append_nameseg(method, "BNUM");
1012             build_append_nameseg(method, "DVNT");
1013             build_append_nameseg(method, "PCIU");
1014             build_append_int(method, 1); /* Device Check */
1015             build_append_nameseg(method, "DVNT");
1016             build_append_nameseg(method, "PCID");
1017             build_append_int(method, 3); /* Eject Request */
1018         }
1019 
1020         /* Notify about child bus events in any case */
1021         build_append_array(method, child->notify_table);
1022 
1023         build_append_and_cleanup_method(bus_table, method);
1024 
1025         /* Append description of child buses */
1026         build_append_array(bus_table, child->device_table);
1027 
1028         /* Pack it up */
1029         if (bus->parent_dev) {
1030             build_extop_package(bus_table, op);
1031         } else {
1032             build_package(bus_table, op, 0);
1033         }
1034 
1035         /* Append our bus description to parent table */
1036         build_append_array(parent->device_table, bus_table);
1037 
1038         /* Also tell parent how to notify us, invoking PCNT method.
1039          * At the moment this is not needed for root as we have a single root.
1040          */
1041         if (bus->parent_dev) {
1042             build_append_byte(parent->notify_table, '^'); /* ParentPrefixChar */
1043             build_append_byte(parent->notify_table, 0x2E); /* DualNamePrefix */
1044             build_append_nameseg(parent->notify_table, "S%.02X",
1045                                  bus->parent_dev->devfn);
1046             build_append_nameseg(parent->notify_table, "PCNT");
1047         }
1048     }
1049 
1050     qobject_decref(bsel);
1051     build_free_array(bus_table);
1052     build_pci_bus_state_cleanup(child);
1053     g_free(child);
1054 }
1055 
1056 static void patch_pci_windows(PcPciInfo *pci, uint8_t *start, unsigned size)
1057 {
1058     ACPI_BUILD_SET_LE(start, size, acpi_pci32_start[0], 32, pci->w32.begin);
1059 
1060     ACPI_BUILD_SET_LE(start, size, acpi_pci32_end[0], 32, pci->w32.end - 1);
1061 
1062     if (pci->w64.end || pci->w64.begin) {
1063         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 1);
1064         ACPI_BUILD_SET_LE(start, size, acpi_pci64_start[0], 64, pci->w64.begin);
1065         ACPI_BUILD_SET_LE(start, size, acpi_pci64_end[0], 64, pci->w64.end - 1);
1066         ACPI_BUILD_SET_LE(start, size, acpi_pci64_length[0], 64, pci->w64.end - pci->w64.begin);
1067     } else {
1068         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 0);
1069     }
1070 }
1071 
1072 static void
1073 build_ssdt(GArray *table_data, GArray *linker,
1074            AcpiCpuInfo *cpu, AcpiPmInfo *pm, AcpiMiscInfo *misc,
1075            PcPciInfo *pci, PcGuestInfo *guest_info)
1076 {
1077     MachineState *machine = MACHINE(qdev_get_machine());
1078     uint32_t nr_mem = machine->ram_slots;
1079     unsigned acpi_cpus = guest_info->apic_id_limit;
1080     int ssdt_start = table_data->len;
1081     uint8_t *ssdt_ptr;
1082     int i;
1083 
1084     /* The current AML generator can cover the APIC ID range [0..255],
1085      * inclusive, for VCPU hotplug. */
1086     QEMU_BUILD_BUG_ON(ACPI_CPU_HOTPLUG_ID_LIMIT > 256);
1087     g_assert(acpi_cpus <= ACPI_CPU_HOTPLUG_ID_LIMIT);
1088 
1089     /* Copy header and patch values in the S3_ / S4_ / S5_ packages */
1090     ssdt_ptr = acpi_data_push(table_data, sizeof(ssdp_misc_aml));
1091     memcpy(ssdt_ptr, ssdp_misc_aml, sizeof(ssdp_misc_aml));
1092     if (pm->s3_disabled) {
1093         ssdt_ptr[acpi_s3_name[0]] = 'X';
1094     }
1095     if (pm->s4_disabled) {
1096         ssdt_ptr[acpi_s4_name[0]] = 'X';
1097     } else {
1098         ssdt_ptr[acpi_s4_pkg[0] + 1] = ssdt_ptr[acpi_s4_pkg[0] + 3] =
1099             pm->s4_val;
1100     }
1101 
1102     patch_pci_windows(pci, ssdt_ptr, sizeof(ssdp_misc_aml));
1103 
1104     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1105                       ssdt_isa_pest[0], 16, misc->pvpanic_port);
1106 
1107     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1108                       ssdt_mctrl_nr_slots[0], 32, nr_mem);
1109 
1110     {
1111         GArray *sb_scope = build_alloc_array();
1112         uint8_t op = 0x10; /* ScopeOp */
1113 
1114         build_append_nameseg(sb_scope, "_SB");
1115 
1116         /* build Processor object for each processor */
1117         for (i = 0; i < acpi_cpus; i++) {
1118             uint8_t *proc = acpi_data_push(sb_scope, ACPI_PROC_SIZEOF);
1119             memcpy(proc, ACPI_PROC_AML, ACPI_PROC_SIZEOF);
1120             proc[ACPI_PROC_OFFSET_CPUHEX] = acpi_get_hex(i >> 4);
1121             proc[ACPI_PROC_OFFSET_CPUHEX+1] = acpi_get_hex(i);
1122             proc[ACPI_PROC_OFFSET_CPUID1] = i;
1123             proc[ACPI_PROC_OFFSET_CPUID2] = i;
1124         }
1125 
1126         /* build this code:
1127          *   Method(NTFY, 2) {If (LEqual(Arg0, 0x00)) {Notify(CP00, Arg1)} ...}
1128          */
1129         /* Arg0 = Processor ID = APIC ID */
1130         build_append_notify_method(sb_scope, "NTFY", "CP%0.02X", acpi_cpus);
1131 
1132         /* build "Name(CPON, Package() { One, One, ..., Zero, Zero, ... })" */
1133         build_append_byte(sb_scope, 0x08); /* NameOp */
1134         build_append_nameseg(sb_scope, "CPON");
1135 
1136         {
1137             GArray *package = build_alloc_array();
1138             uint8_t op;
1139 
1140             /*
1141              * Note: The ability to create variable-sized packages was first introduced in ACPI 2.0. ACPI 1.0 only
1142              * allowed fixed-size packages with up to 255 elements.
1143              * Windows guests up to win2k8 fail when VarPackageOp is used.
1144              */
1145             if (acpi_cpus <= 255) {
1146                 op = 0x12; /* PackageOp */
1147                 build_append_byte(package, acpi_cpus); /* NumElements */
1148             } else {
1149                 op = 0x13; /* VarPackageOp */
1150                 build_append_int(package, acpi_cpus); /* VarNumElements */
1151             }
1152 
1153             for (i = 0; i < acpi_cpus; i++) {
1154                 uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00;
1155                 build_append_byte(package, b);
1156             }
1157 
1158             build_package(package, op, 2);
1159             build_append_array(sb_scope, package);
1160             build_free_array(package);
1161         }
1162 
1163         if (nr_mem) {
1164             assert(nr_mem <= ACPI_MAX_RAM_SLOTS);
1165             /* build memory devices */
1166             for (i = 0; i < nr_mem; i++) {
1167                 char id[3];
1168                 uint8_t *mem = acpi_data_push(sb_scope, ACPI_MEM_SIZEOF);
1169 
1170                 snprintf(id, sizeof(id), "%02X", i);
1171                 memcpy(mem, ACPI_MEM_AML, ACPI_MEM_SIZEOF);
1172                 memcpy(mem + ACPI_MEM_OFFSET_HEX, id, 2);
1173                 memcpy(mem + ACPI_MEM_OFFSET_ID, id, 2);
1174             }
1175 
1176             /* build Method(MEMORY_SLOT_NOTIFY_METHOD, 2) {
1177              *     If (LEqual(Arg0, 0x00)) {Notify(MP00, Arg1)} ...
1178              */
1179             build_append_notify_method(sb_scope,
1180                                        stringify(MEMORY_SLOT_NOTIFY_METHOD),
1181                                        "MP%0.02X", nr_mem);
1182         }
1183 
1184         {
1185             AcpiBuildPciBusHotplugState hotplug_state;
1186             Object *pci_host;
1187             PCIBus *bus = NULL;
1188             bool ambiguous;
1189 
1190             pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1191             if (!ambiguous && pci_host) {
1192                 bus = PCI_HOST_BRIDGE(pci_host)->bus;
1193             }
1194 
1195             build_pci_bus_state_init(&hotplug_state, NULL, pm->pcihp_bridge_en);
1196 
1197             if (bus) {
1198                 /* Scan all PCI buses. Generate tables to support hotplug. */
1199                 pci_for_each_bus_depth_first(bus, build_pci_bus_begin,
1200                                              build_pci_bus_end, &hotplug_state);
1201             }
1202 
1203             build_append_array(sb_scope, hotplug_state.device_table);
1204             build_pci_bus_state_cleanup(&hotplug_state);
1205         }
1206 
1207         build_package(sb_scope, op, 3);
1208         build_append_array(table_data, sb_scope);
1209         build_free_array(sb_scope);
1210     }
1211 
1212     build_header(linker, table_data,
1213                  (void *)(table_data->data + ssdt_start),
1214                  "SSDT", table_data->len - ssdt_start, 1);
1215 }
1216 
1217 static void
1218 build_hpet(GArray *table_data, GArray *linker)
1219 {
1220     Acpi20Hpet *hpet;
1221 
1222     hpet = acpi_data_push(table_data, sizeof(*hpet));
1223     /* Note timer_block_id value must be kept in sync with value advertised by
1224      * emulated hpet
1225      */
1226     hpet->timer_block_id = cpu_to_le32(0x8086a201);
1227     hpet->addr.address = cpu_to_le64(HPET_BASE);
1228     build_header(linker, table_data,
1229                  (void *)hpet, "HPET", sizeof(*hpet), 1);
1230 }
1231 
1232 static void
1233 build_tpm_tcpa(GArray *table_data, GArray *linker, GArray *tcpalog)
1234 {
1235     Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa);
1236     uint64_t log_area_start_address = acpi_data_len(tcpalog);
1237 
1238     tcpa->platform_class = cpu_to_le16(TPM_TCPA_ACPI_CLASS_CLIENT);
1239     tcpa->log_area_minimum_length = cpu_to_le32(TPM_LOG_AREA_MINIMUM_SIZE);
1240     tcpa->log_area_start_address = cpu_to_le64(log_area_start_address);
1241 
1242     bios_linker_loader_alloc(linker, ACPI_BUILD_TPMLOG_FILE, 1,
1243                              false /* high memory */);
1244 
1245     /* log area start address to be filled by Guest linker */
1246     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
1247                                    ACPI_BUILD_TPMLOG_FILE,
1248                                    table_data, &tcpa->log_area_start_address,
1249                                    sizeof(tcpa->log_area_start_address));
1250 
1251     build_header(linker, table_data,
1252                  (void *)tcpa, "TCPA", sizeof(*tcpa), 2);
1253 
1254     acpi_data_push(tcpalog, TPM_LOG_AREA_MINIMUM_SIZE);
1255 }
1256 
1257 static void
1258 build_tpm_ssdt(GArray *table_data, GArray *linker)
1259 {
1260     void *tpm_ptr;
1261 
1262     tpm_ptr = acpi_data_push(table_data, sizeof(ssdt_tpm_aml));
1263     memcpy(tpm_ptr, ssdt_tpm_aml, sizeof(ssdt_tpm_aml));
1264 }
1265 
1266 typedef enum {
1267     MEM_AFFINITY_NOFLAGS      = 0,
1268     MEM_AFFINITY_ENABLED      = (1 << 0),
1269     MEM_AFFINITY_HOTPLUGGABLE = (1 << 1),
1270     MEM_AFFINITY_NON_VOLATILE = (1 << 2),
1271 } MemoryAffinityFlags;
1272 
1273 static void
1274 acpi_build_srat_memory(AcpiSratMemoryAffinity *numamem, uint64_t base,
1275                        uint64_t len, int node, MemoryAffinityFlags flags)
1276 {
1277     numamem->type = ACPI_SRAT_MEMORY;
1278     numamem->length = sizeof(*numamem);
1279     memset(numamem->proximity, 0, 4);
1280     numamem->proximity[0] = node;
1281     numamem->flags = cpu_to_le32(flags);
1282     numamem->base_addr = cpu_to_le64(base);
1283     numamem->range_length = cpu_to_le64(len);
1284 }
1285 
1286 static void
1287 build_srat(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
1288 {
1289     AcpiSystemResourceAffinityTable *srat;
1290     AcpiSratProcessorAffinity *core;
1291     AcpiSratMemoryAffinity *numamem;
1292 
1293     int i;
1294     uint64_t curnode;
1295     int srat_start, numa_start, slots;
1296     uint64_t mem_len, mem_base, next_base;
1297     PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
1298     ram_addr_t hotplugabble_address_space_size =
1299         object_property_get_int(OBJECT(pcms), PC_MACHINE_MEMHP_REGION_SIZE,
1300                                 NULL);
1301 
1302     srat_start = table_data->len;
1303 
1304     srat = acpi_data_push(table_data, sizeof *srat);
1305     srat->reserved1 = cpu_to_le32(1);
1306     core = (void *)(srat + 1);
1307 
1308     for (i = 0; i < guest_info->apic_id_limit; ++i) {
1309         core = acpi_data_push(table_data, sizeof *core);
1310         core->type = ACPI_SRAT_PROCESSOR;
1311         core->length = sizeof(*core);
1312         core->local_apic_id = i;
1313         curnode = guest_info->node_cpu[i];
1314         core->proximity_lo = curnode;
1315         memset(core->proximity_hi, 0, 3);
1316         core->local_sapic_eid = 0;
1317         core->flags = cpu_to_le32(1);
1318     }
1319 
1320 
1321     /* the memory map is a bit tricky, it contains at least one hole
1322      * from 640k-1M and possibly another one from 3.5G-4G.
1323      */
1324     next_base = 0;
1325     numa_start = table_data->len;
1326 
1327     numamem = acpi_data_push(table_data, sizeof *numamem);
1328     acpi_build_srat_memory(numamem, 0, 640*1024, 0, MEM_AFFINITY_ENABLED);
1329     next_base = 1024 * 1024;
1330     for (i = 1; i < guest_info->numa_nodes + 1; ++i) {
1331         mem_base = next_base;
1332         mem_len = guest_info->node_mem[i - 1];
1333         if (i == 1) {
1334             mem_len -= 1024 * 1024;
1335         }
1336         next_base = mem_base + mem_len;
1337 
1338         /* Cut out the ACPI_PCI hole */
1339         if (mem_base <= guest_info->ram_size_below_4g &&
1340             next_base > guest_info->ram_size_below_4g) {
1341             mem_len -= next_base - guest_info->ram_size_below_4g;
1342             if (mem_len > 0) {
1343                 numamem = acpi_data_push(table_data, sizeof *numamem);
1344                 acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1345                                        MEM_AFFINITY_ENABLED);
1346             }
1347             mem_base = 1ULL << 32;
1348             mem_len = next_base - guest_info->ram_size_below_4g;
1349             next_base += (1ULL << 32) - guest_info->ram_size_below_4g;
1350         }
1351         numamem = acpi_data_push(table_data, sizeof *numamem);
1352         acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1353                                MEM_AFFINITY_ENABLED);
1354     }
1355     slots = (table_data->len - numa_start) / sizeof *numamem;
1356     for (; slots < guest_info->numa_nodes + 2; slots++) {
1357         numamem = acpi_data_push(table_data, sizeof *numamem);
1358         acpi_build_srat_memory(numamem, 0, 0, 0, MEM_AFFINITY_NOFLAGS);
1359     }
1360 
1361     /*
1362      * Entry is required for Windows to enable memory hotplug in OS.
1363      * Memory devices may override proximity set by this entry,
1364      * providing _PXM method if necessary.
1365      */
1366     if (hotplugabble_address_space_size) {
1367         numamem = acpi_data_push(table_data, sizeof *numamem);
1368         acpi_build_srat_memory(numamem, pcms->hotplug_memory_base,
1369                                hotplugabble_address_space_size, 0,
1370                                MEM_AFFINITY_HOTPLUGGABLE |
1371                                MEM_AFFINITY_ENABLED);
1372     }
1373 
1374     build_header(linker, table_data,
1375                  (void *)(table_data->data + srat_start),
1376                  "SRAT",
1377                  table_data->len - srat_start, 1);
1378 }
1379 
1380 static void
1381 build_mcfg_q35(GArray *table_data, GArray *linker, AcpiMcfgInfo *info)
1382 {
1383     AcpiTableMcfg *mcfg;
1384     const char *sig;
1385     int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);
1386 
1387     mcfg = acpi_data_push(table_data, len);
1388     mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);
1389     /* Only a single allocation so no need to play with segments */
1390     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
1391     mcfg->allocation[0].start_bus_number = 0;
1392     mcfg->allocation[0].end_bus_number = PCIE_MMCFG_BUS(info->mcfg_size - 1);
1393 
1394     /* MCFG is used for ECAM which can be enabled or disabled by guest.
1395      * To avoid table size changes (which create migration issues),
1396      * always create the table even if there are no allocations,
1397      * but set the signature to a reserved value in this case.
1398      * ACPI spec requires OSPMs to ignore such tables.
1399      */
1400     if (info->mcfg_base == PCIE_BASE_ADDR_UNMAPPED) {
1401         /* Reserved signature: ignored by OSPM */
1402         sig = "QEMU";
1403     } else {
1404         sig = "MCFG";
1405     }
1406     build_header(linker, table_data, (void *)mcfg, sig, len, 1);
1407 }
1408 
1409 static void
1410 build_dmar_q35(GArray *table_data, GArray *linker)
1411 {
1412     int dmar_start = table_data->len;
1413 
1414     AcpiTableDmar *dmar;
1415     AcpiDmarHardwareUnit *drhd;
1416 
1417     dmar = acpi_data_push(table_data, sizeof(*dmar));
1418     dmar->host_address_width = VTD_HOST_ADDRESS_WIDTH - 1;
1419     dmar->flags = 0;    /* No intr_remap for now */
1420 
1421     /* DMAR Remapping Hardware Unit Definition structure */
1422     drhd = acpi_data_push(table_data, sizeof(*drhd));
1423     drhd->type = cpu_to_le16(ACPI_DMAR_TYPE_HARDWARE_UNIT);
1424     drhd->length = cpu_to_le16(sizeof(*drhd));   /* No device scope now */
1425     drhd->flags = ACPI_DMAR_INCLUDE_PCI_ALL;
1426     drhd->pci_segment = cpu_to_le16(0);
1427     drhd->address = cpu_to_le64(Q35_HOST_BRIDGE_IOMMU_ADDR);
1428 
1429     build_header(linker, table_data, (void *)(table_data->data + dmar_start),
1430                  "DMAR", table_data->len - dmar_start, 1);
1431 }
1432 
1433 static void
1434 build_dsdt(GArray *table_data, GArray *linker, AcpiMiscInfo *misc)
1435 {
1436     AcpiTableHeader *dsdt;
1437 
1438     assert(misc->dsdt_code && misc->dsdt_size);
1439 
1440     dsdt = acpi_data_push(table_data, misc->dsdt_size);
1441     memcpy(dsdt, misc->dsdt_code, misc->dsdt_size);
1442 
1443     memset(dsdt, 0, sizeof *dsdt);
1444     build_header(linker, table_data, dsdt, "DSDT",
1445                  misc->dsdt_size, 1);
1446 }
1447 
1448 /* Build final rsdt table */
1449 static void
1450 build_rsdt(GArray *table_data, GArray *linker, GArray *table_offsets)
1451 {
1452     AcpiRsdtDescriptorRev1 *rsdt;
1453     size_t rsdt_len;
1454     int i;
1455 
1456     rsdt_len = sizeof(*rsdt) + sizeof(uint32_t) * table_offsets->len;
1457     rsdt = acpi_data_push(table_data, rsdt_len);
1458     memcpy(rsdt->table_offset_entry, table_offsets->data,
1459            sizeof(uint32_t) * table_offsets->len);
1460     for (i = 0; i < table_offsets->len; ++i) {
1461         /* rsdt->table_offset_entry to be filled by Guest linker */
1462         bios_linker_loader_add_pointer(linker,
1463                                        ACPI_BUILD_TABLE_FILE,
1464                                        ACPI_BUILD_TABLE_FILE,
1465                                        table_data, &rsdt->table_offset_entry[i],
1466                                        sizeof(uint32_t));
1467     }
1468     build_header(linker, table_data,
1469                  (void *)rsdt, "RSDT", rsdt_len, 1);
1470 }
1471 
1472 static GArray *
1473 build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)
1474 {
1475     AcpiRsdpDescriptor *rsdp = acpi_data_push(rsdp_table, sizeof *rsdp);
1476 
1477     bios_linker_loader_alloc(linker, ACPI_BUILD_RSDP_FILE, 16,
1478                              true /* fseg memory */);
1479 
1480     memcpy(&rsdp->signature, "RSD PTR ", 8);
1481     memcpy(rsdp->oem_id, ACPI_BUILD_APPNAME6, 6);
1482     rsdp->rsdt_physical_address = cpu_to_le32(rsdt);
1483     /* Address to be filled by Guest linker */
1484     bios_linker_loader_add_pointer(linker, ACPI_BUILD_RSDP_FILE,
1485                                    ACPI_BUILD_TABLE_FILE,
1486                                    rsdp_table, &rsdp->rsdt_physical_address,
1487                                    sizeof rsdp->rsdt_physical_address);
1488     rsdp->checksum = 0;
1489     /* Checksum to be filled by Guest linker */
1490     bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,
1491                                     rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);
1492 
1493     return rsdp_table;
1494 }
1495 
1496 typedef
1497 struct AcpiBuildTables {
1498     GArray *table_data;
1499     GArray *rsdp;
1500     GArray *tcpalog;
1501     GArray *linker;
1502 } AcpiBuildTables;
1503 
1504 static inline void acpi_build_tables_init(AcpiBuildTables *tables)
1505 {
1506     tables->rsdp = g_array_new(false, true /* clear */, 1);
1507     tables->table_data = g_array_new(false, true /* clear */, 1);
1508     tables->tcpalog = g_array_new(false, true /* clear */, 1);
1509     tables->linker = bios_linker_loader_init();
1510 }
1511 
1512 static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)
1513 {
1514     void *linker_data = bios_linker_loader_cleanup(tables->linker);
1515     g_free(linker_data);
1516     g_array_free(tables->rsdp, mfre);
1517     g_array_free(tables->table_data, true);
1518     g_array_free(tables->tcpalog, mfre);
1519 }
1520 
1521 typedef
1522 struct AcpiBuildState {
1523     /* Copy of table in RAM (for patching). */
1524     ram_addr_t table_ram;
1525     uint32_t table_size;
1526     /* Is table patched? */
1527     uint8_t patched;
1528     PcGuestInfo *guest_info;
1529 } AcpiBuildState;
1530 
1531 static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
1532 {
1533     Object *pci_host;
1534     QObject *o;
1535     bool ambiguous;
1536 
1537     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1538     g_assert(!ambiguous);
1539     g_assert(pci_host);
1540 
1541     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_BASE, NULL);
1542     if (!o) {
1543         return false;
1544     }
1545     mcfg->mcfg_base = qint_get_int(qobject_to_qint(o));
1546     qobject_decref(o);
1547 
1548     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL);
1549     assert(o);
1550     mcfg->mcfg_size = qint_get_int(qobject_to_qint(o));
1551     qobject_decref(o);
1552     return true;
1553 }
1554 
1555 static bool acpi_has_iommu(void)
1556 {
1557     bool ambiguous;
1558     Object *intel_iommu;
1559 
1560     intel_iommu = object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE,
1561                                            &ambiguous);
1562     return intel_iommu && !ambiguous;
1563 }
1564 
1565 static
1566 void acpi_build(PcGuestInfo *guest_info, AcpiBuildTables *tables)
1567 {
1568     GArray *table_offsets;
1569     unsigned facs, ssdt, dsdt, rsdt;
1570     AcpiCpuInfo cpu;
1571     AcpiPmInfo pm;
1572     AcpiMiscInfo misc;
1573     AcpiMcfgInfo mcfg;
1574     PcPciInfo pci;
1575     uint8_t *u;
1576     size_t aml_len = 0;
1577 
1578     acpi_get_cpu_info(&cpu);
1579     acpi_get_pm_info(&pm);
1580     acpi_get_dsdt(&misc);
1581     acpi_get_misc_info(&misc);
1582     acpi_get_pci_info(&pci);
1583 
1584     table_offsets = g_array_new(false, true /* clear */,
1585                                         sizeof(uint32_t));
1586     ACPI_BUILD_DPRINTF("init ACPI tables\n");
1587 
1588     bios_linker_loader_alloc(tables->linker, ACPI_BUILD_TABLE_FILE,
1589                              64 /* Ensure FACS is aligned */,
1590                              false /* high memory */);
1591 
1592     /*
1593      * FACS is pointed to by FADT.
1594      * We place it first since it's the only table that has alignment
1595      * requirements.
1596      */
1597     facs = tables->table_data->len;
1598     build_facs(tables->table_data, tables->linker, guest_info);
1599 
1600     /* DSDT is pointed to by FADT */
1601     dsdt = tables->table_data->len;
1602     build_dsdt(tables->table_data, tables->linker, &misc);
1603 
1604     /* Count the size of the DSDT and SSDT, we will need it for legacy
1605      * sizing of ACPI tables.
1606      */
1607     aml_len += tables->table_data->len - dsdt;
1608 
1609     /* ACPI tables pointed to by RSDT */
1610     acpi_add_table(table_offsets, tables->table_data);
1611     build_fadt(tables->table_data, tables->linker, &pm, facs, dsdt);
1612 
1613     ssdt = tables->table_data->len;
1614     acpi_add_table(table_offsets, tables->table_data);
1615     build_ssdt(tables->table_data, tables->linker, &cpu, &pm, &misc, &pci,
1616                guest_info);
1617     aml_len += tables->table_data->len - ssdt;
1618 
1619     acpi_add_table(table_offsets, tables->table_data);
1620     build_madt(tables->table_data, tables->linker, &cpu, guest_info);
1621 
1622     if (misc.has_hpet) {
1623         acpi_add_table(table_offsets, tables->table_data);
1624         build_hpet(tables->table_data, tables->linker);
1625     }
1626     if (misc.has_tpm) {
1627         acpi_add_table(table_offsets, tables->table_data);
1628         build_tpm_tcpa(tables->table_data, tables->linker, tables->tcpalog);
1629 
1630         acpi_add_table(table_offsets, tables->table_data);
1631         build_tpm_ssdt(tables->table_data, tables->linker);
1632     }
1633     if (guest_info->numa_nodes) {
1634         acpi_add_table(table_offsets, tables->table_data);
1635         build_srat(tables->table_data, tables->linker, guest_info);
1636     }
1637     if (acpi_get_mcfg(&mcfg)) {
1638         acpi_add_table(table_offsets, tables->table_data);
1639         build_mcfg_q35(tables->table_data, tables->linker, &mcfg);
1640     }
1641     if (acpi_has_iommu()) {
1642         acpi_add_table(table_offsets, tables->table_data);
1643         build_dmar_q35(tables->table_data, tables->linker);
1644     }
1645 
1646     /* Add tables supplied by user (if any) */
1647     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
1648         unsigned len = acpi_table_len(u);
1649 
1650         acpi_add_table(table_offsets, tables->table_data);
1651         g_array_append_vals(tables->table_data, u, len);
1652     }
1653 
1654     /* RSDT is pointed to by RSDP */
1655     rsdt = tables->table_data->len;
1656     build_rsdt(tables->table_data, tables->linker, table_offsets);
1657 
1658     /* RSDP is in FSEG memory, so allocate it separately */
1659     build_rsdp(tables->rsdp, tables->linker, rsdt);
1660 
1661     /* We'll expose it all to Guest so we want to reduce
1662      * chance of size changes.
1663      * RSDP is small so it's easy to keep it immutable, no need to
1664      * bother with alignment.
1665      *
1666      * We used to align the tables to 4k, but of course this would
1667      * too simple to be enough.  4k turned out to be too small an
1668      * alignment very soon, and in fact it is almost impossible to
1669      * keep the table size stable for all (max_cpus, max_memory_slots)
1670      * combinations.  So the table size is always 64k for pc-i440fx-2.1
1671      * and we give an error if the table grows beyond that limit.
1672      *
1673      * We still have the problem of migrating from "-M pc-i440fx-2.0".  For
1674      * that, we exploit the fact that QEMU 2.1 generates _smaller_ tables
1675      * than 2.0 and we can always pad the smaller tables with zeros.  We can
1676      * then use the exact size of the 2.0 tables.
1677      *
1678      * All this is for PIIX4, since QEMU 2.0 didn't support Q35 migration.
1679      */
1680     if (guest_info->legacy_acpi_table_size) {
1681         /* Subtracting aml_len gives the size of fixed tables.  Then add the
1682          * size of the PIIX4 DSDT/SSDT in QEMU 2.0.
1683          */
1684         int legacy_aml_len =
1685             guest_info->legacy_acpi_table_size +
1686             ACPI_BUILD_LEGACY_CPU_AML_SIZE * max_cpus;
1687         int legacy_table_size =
1688             ROUND_UP(tables->table_data->len - aml_len + legacy_aml_len,
1689                      ACPI_BUILD_ALIGN_SIZE);
1690         if (tables->table_data->len > legacy_table_size) {
1691             /* Should happen only with PCI bridges and -M pc-i440fx-2.0.  */
1692             error_report("Warning: migration may not work.");
1693         }
1694         g_array_set_size(tables->table_data, legacy_table_size);
1695     } else {
1696         /* Make sure we have a buffer in case we need to resize the tables. */
1697         if (tables->table_data->len > ACPI_BUILD_TABLE_SIZE / 2) {
1698             /* As of QEMU 2.1, this fires with 160 VCPUs and 255 memory slots.  */
1699             error_report("Warning: ACPI tables are larger than 64k.");
1700             error_report("Warning: migration may not work.");
1701             error_report("Warning: please remove CPUs, NUMA nodes, "
1702                          "memory slots or PCI bridges.");
1703         }
1704         acpi_align_size(tables->table_data, ACPI_BUILD_TABLE_SIZE);
1705     }
1706 
1707     acpi_align_size(tables->linker, ACPI_BUILD_ALIGN_SIZE);
1708 
1709     /* Cleanup memory that's no longer used. */
1710     g_array_free(table_offsets, true);
1711 }
1712 
1713 static void acpi_build_update(void *build_opaque, uint32_t offset)
1714 {
1715     AcpiBuildState *build_state = build_opaque;
1716     AcpiBuildTables tables;
1717 
1718     /* No state to update or already patched? Nothing to do. */
1719     if (!build_state || build_state->patched) {
1720         return;
1721     }
1722     build_state->patched = 1;
1723 
1724     acpi_build_tables_init(&tables);
1725 
1726     acpi_build(build_state->guest_info, &tables);
1727 
1728     assert(acpi_data_len(tables.table_data) == build_state->table_size);
1729 
1730     /* Make sure RAM size is correct - in case it got changed by migration */
1731     qemu_ram_resize(build_state->table_ram, build_state->table_size,
1732                     &error_abort);
1733 
1734     memcpy(qemu_get_ram_ptr(build_state->table_ram), tables.table_data->data,
1735            build_state->table_size);
1736 
1737     cpu_physical_memory_set_dirty_range_nocode(build_state->table_ram,
1738                                                build_state->table_size);
1739 
1740     acpi_build_tables_cleanup(&tables, true);
1741 }
1742 
1743 static void acpi_build_reset(void *build_opaque)
1744 {
1745     AcpiBuildState *build_state = build_opaque;
1746     build_state->patched = 0;
1747 }
1748 
1749 static ram_addr_t acpi_add_rom_blob(AcpiBuildState *build_state, GArray *blob,
1750                                const char *name, uint64_t max_size)
1751 {
1752     return rom_add_blob(name, blob->data, acpi_data_len(blob), max_size, -1,
1753                         name, acpi_build_update, build_state);
1754 }
1755 
1756 static const VMStateDescription vmstate_acpi_build = {
1757     .name = "acpi_build",
1758     .version_id = 1,
1759     .minimum_version_id = 1,
1760     .fields = (VMStateField[]) {
1761         VMSTATE_UINT8(patched, AcpiBuildState),
1762         VMSTATE_END_OF_LIST()
1763     },
1764 };
1765 
1766 void acpi_setup(PcGuestInfo *guest_info)
1767 {
1768     AcpiBuildTables tables;
1769     AcpiBuildState *build_state;
1770 
1771     if (!guest_info->fw_cfg) {
1772         ACPI_BUILD_DPRINTF("No fw cfg. Bailing out.\n");
1773         return;
1774     }
1775 
1776     if (!guest_info->has_acpi_build) {
1777         ACPI_BUILD_DPRINTF("ACPI build disabled. Bailing out.\n");
1778         return;
1779     }
1780 
1781     if (!acpi_enabled) {
1782         ACPI_BUILD_DPRINTF("ACPI disabled. Bailing out.\n");
1783         return;
1784     }
1785 
1786     build_state = g_malloc0(sizeof *build_state);
1787 
1788     build_state->guest_info = guest_info;
1789 
1790     acpi_set_pci_info();
1791 
1792     acpi_build_tables_init(&tables);
1793     acpi_build(build_state->guest_info, &tables);
1794 
1795     /* Now expose it all to Guest */
1796     build_state->table_ram = acpi_add_rom_blob(build_state, tables.table_data,
1797                                                ACPI_BUILD_TABLE_FILE,
1798                                                ACPI_BUILD_TABLE_MAX_SIZE);
1799     assert(build_state->table_ram != RAM_ADDR_MAX);
1800     build_state->table_size = acpi_data_len(tables.table_data);
1801 
1802     acpi_add_rom_blob(NULL, tables.linker, "etc/table-loader", 0);
1803 
1804     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_TPMLOG_FILE,
1805                     tables.tcpalog->data, acpi_data_len(tables.tcpalog));
1806 
1807     /*
1808      * RSDP is small so it's easy to keep it immutable, no need to
1809      * bother with ROM blobs.
1810      */
1811     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_RSDP_FILE,
1812                     tables.rsdp->data, acpi_data_len(tables.rsdp));
1813 
1814     qemu_register_reset(acpi_build_reset, build_state);
1815     acpi_build_reset(build_state);
1816     vmstate_register(NULL, 0, &vmstate_acpi_build, build_state);
1817 
1818     /* Cleanup tables but don't free the memory: we track it
1819      * in build_state.
1820      */
1821     acpi_build_tables_cleanup(&tables, false);
1822 }
1823